Is it possible to secure an assembly called by a web app?

From: Bosco (Bosco_at_discussions.microsoft.com)
Date: 09/22/04 

Date: Tue, 21 Sep 2004 15:49:01 -0700

I am writing an assembly in the 1.1 framework that will be called by an
ASP.NET application and I have a few questions about security.

First off the assembly to be called by the web app is 'privileged code' as
it makes numerous calls to both DirectoryServices and possibly in the future
ADO.

I am trying to understand how I can use Code Access Security or
Identity/Principal objects in order to authorize access to the public Classes
and methods of my privileged dll.

I cannot strong name the ASP assembly so I couldn't simply place Code Access
Security on the privileged assembly limiting it to the ASP assembly only.
And also, if I understand correctly, ASP Principal and Identity objects work
differently in ASP assemblies than in non-ASP assemblies. i.e. in non-ASP
assemblies the identity is tied to the thread where as in ASP the identity is
tied to
cookies or some other form of session state.

So how does a privileged dll that is to be called by an ASP web application
assembly restrict access to it's public classes and methods or implement any
sort of security policy at all?

Thanks in advance,
-------------
Bosco 

-- 
-----------
Bosco

Relevant Pages

  • Re: Code Access Security Enforcement anamoly - - Thx in advance.
    ... If we look at the documentation and security changes since v1.0 of .NET, ... so that any assemblies under that website would be considered as fully ... > Hi Shawn, ... >> You are probably running into a situation with dynamic compilation. ...
    (microsoft.public.dotnet.security)
  • Re: Am I the only one with doubts about .NET for commercial apps?
    ... > So far, I have found only these two weaknesses, but these are BIG ... harder to do in unmanaged code, no licensing restrictions you add there are ... sense of security by making it clearer how easy it is to do. ... You can make reusing your assemblies a bit harder by using identity demands, ...
    (microsoft.public.dotnet.general)
  • RE: Decleration Excel.Application or what
    ... security error when you call into the NanoSort class. ... When you create and build your VSTO project a .NET security policy is ... assemblies reside rather than just the VSTO assembly and this should correct ...
    (microsoft.public.vsnet.vstools.office)
  • RE: Windows Service cannot create text files?
    ... should know that running your service as the Local System account is Very ... If your service has a single security flaw that is exploited, ... The steps for changing the policy for the user ... This will import the strong name and only assemblies ...
    (microsoft.public.dotnet.languages.vb)
  • ANN: Free .NET Workshops
    ... Richard Grimes has made available some of his .NET training courses as ... - Location of .NET assemblies and how to change the default locations ... ..NET Security Workshop ... - Cryptography; Crypto transforms and crypto streams; Keys and ...
    (microsoft.public.dotnet.faqs)